CVE-2022-26306 in LibreOffice
Summary
by MITRE • 07/25/2022
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2022-26306 represents a critical weakness in LibreOffice's password storage mechanism that undermines the security of user credentials stored for web connections. This flaw resides in the encryption implementation where passwords are supposed to be protected using a master key provided by the user, yet the cryptographic implementation contains a fundamental design error that significantly weakens the overall security posture. The vulnerability specifically impacts LibreOffice versions 7.2.x prior to 7.2.7 and 7.3.x prior to 7.3.1, making these versions particularly susceptible to credential compromise when attackers gain access to user configuration databases. The issue stems from a predictable initialization vector that remains constant across all password encryption operations, which violates established cryptographic best practices and creates a significant attack surface.
The technical flaw manifests in the deterministic nature of the encryption process where the same initialization vector is reused for each password encryption operation, effectively eliminating the randomness that cryptographic systems require to maintain security. This weakness aligns with CWE-327, which addresses the use of insecure encryption algorithms or improper implementation of cryptographic functions, and specifically relates to the improper use of initialization vectors in block cipher modes. The predictable initialization vector creates a scenario where attackers can potentially perform statistical analysis on encrypted password data to infer patterns or even recover the original passwords, particularly when multiple passwords are stored using the same master key. This vulnerability essentially transforms what should be a secure encrypted storage mechanism into a weak point that can be exploited through cryptanalysis or pattern recognition attacks.
The operational impact of this vulnerability extends beyond simple credential theft, as it creates a persistent security risk for users who rely on LibreOffice for document management and web connectivity. When attackers compromise a user's configuration database, they gain access to not only the encrypted passwords but also the predictable encryption patterns that make recovery significantly easier. This issue affects users who store web connection credentials for various services such as online document repositories, cloud storage integrations, or web-based database connections, making the compromise of these credentials potentially devastating for enterprise security. The vulnerability operates at the application level and can be exploited through local file system access or through compromised user accounts that have access to the configuration database files. According to ATT&CK framework category T1552, this vulnerability enables credential access through the exploitation of stored credentials, while also falling under T1003 which addresses credential dumping and access to sensitive information.
The mitigation strategy for CVE-2022-26306 requires immediate upgrading to LibreOffice versions 7.2.7 or 7.3.1, which contain the necessary cryptographic fixes to address the initialization vector reuse issue. Users should also consider implementing additional security controls such as file system access restrictions, regular configuration database audits, and monitoring for unauthorized access to user profile directories. Security administrators should conduct vulnerability assessments to identify systems running affected LibreOffice versions and ensure proper patch management procedures are in place. Organizations should also consider implementing multi-factor authentication for web services that rely on stored credentials, as this vulnerability demonstrates the importance of layered security approaches. The fix implemented in the patched versions addresses the core cryptographic weakness by ensuring that each encryption operation uses a unique initialization vector, thereby restoring the intended security properties of the encryption mechanism and preventing the predictable pattern that made the passwords vulnerable to analysis.